Skip to content

Commit 62a14c5

Browse files
TravisEz13adityapatwardhan
TravisEz13
and
adityapatwardhan
authored
Move to OneBranch Signing and SBOM generation (#1982)
* Updates to signing * fix files to sign * sbom changes * format changes * Make packaging wait on build * clarify task display names * Make sure signing is setup * move other tasks to restore phase * move checkout to restore phase * update container * move signing to it's own job * add flag required for newest container * clarify copy files task displaynames * reuse existing variable * removed unneeded code * Use correct path is signing job * sign the nupkg * fix syntax * Revert "clarify copy files task displaynames" This reverts commit 1bdc123. * Disable code sign validation on first job * search for where OBP put dotnet.exe * Move SDK search to it's own job * delete SDK search * make nupkg signing a todo * fix nupkg publishing * try disabling codeql to get signing working per docs * don't setup signing where not needed * combine sign and build job * set version for SBOM * make comments more accurate * Apply suggestions from code review * fix variable name * address pr comments --------- Co-authored-by: Aditya Patwardhan <adityap@microsoft.com>
1 parent 03b655c commit 62a14c5

File tree

1 file changed

+143
-85
lines changed

1 file changed

+143
-85
lines changed

‎.pipelines/OSS_Microsoft_PSSA-Official.yml‎

Lines changed: 143 additions & 85 deletions
Original file line numberDiff line numberDiff line change
@@ -9,30 +9,29 @@ pr:
99
- master
1010
- release*
1111
variables:
12-
- name: DOTNET_CLI_TELEMETRY_OPTOUT
13-
value: 1
14-
- name: POWERSHELL_TELEMETRY_OPTOUT
15-
value: 1
16-
- name: WindowsContainerImage
17-
value: onebranch.azurecr.io/windows/ltsc2019/vse2022:latest
12+
- name: DOTNET_CLI_TELEMETRY_OPTOUT
13+
value: 1
14+
- name: POWERSHELL_TELEMETRY_OPTOUT
15+
value: 1
16+
- name: WindowsContainerImage
17+
value: onebranch.azurecr.io/windows/ltsc2022/vse2022:latest
1818
resources:
1919
repositories:
20-
- repository: ComplianceRepo
21-
type: github
22-
endpoint: ComplianceGHRepo
23-
name: PowerShell/compliance
24-
ref: master
2520
- repository: onebranchTemplates
2621
type: git
2722
name: OneBranch.Pipelines/GovernedTemplates
2823
ref: refs/heads/main
2924
extends:
3025
template: v2/OneBranch.Official.CrossPlat.yml@onebranchTemplates
3126
parameters:
27+
featureFlags:
28+
WindowsHostVersion: '1ESWindows2022'
3229
customTags: 'ES365AIMigrationTooling'
3330
globalSdl:
31+
disableLegacyManifest: true
3432
sbom:
35-
enabled: false
33+
enabled: true
34+
packageName: Microsoft.PowerShell.ScriptAnalyzer
3635
codeql:
3736
compiled:
3837
enabled: true
@@ -48,113 +47,172 @@ extends:
4847
enabled: false
4948

5049
stages:
51-
- stage: Build
52-
displayName: Build
50+
- stage: stagebuild
51+
displayName: Build and Package Microsoft.PowerShell.ScriptAnalyzer
5352
jobs:
54-
- job: Build_Job
55-
displayName: Build Microsoft.PowerShell.ScriptAnalyzer
53+
- job: jobbuild
54+
displayName: Build Microsoft.PowerShell.ScriptAnalyzer Files
5655
variables:
57-
- group: ESRP
5856
- name: ob_outputDirectory
5957
value: '$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT'
6058
- name: repoRoot
6159
value: $(Build.SourcesDirectory)\OSS_Microsoft_PSSA
6260
- name: ob_sdl_tsa_configFile
6361
value: $(Build.SourcesDirectory)\OSS_Microsoft_PSSA\.config\tsaoptions.json
62+
- name: signSrcPath
63+
value: $(repoRoot)/out
64+
- name: ob_sdl_sbom_enabled
65+
value: true
66+
- name: ob_signing_setup_enabled
67+
value: true
68+
#CodeQL tasks added manually to workaround signing failures
69+
- name: ob_sdl_codeql_compiled_enabled
70+
value: false
71+
6472
pool:
6573
type: windows
6674
steps:
6775
- checkout: self
68-
- checkout: ComplianceRepo
76+
env:
77+
ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.
6978

7079
- pwsh: |
7180
if (-not (Test-Path $(repoRoot)/.config/tsaoptions.json)) {
7281
Get-ChildItem $(Build.SourcesDirectory) -recurse -ErrorAction SilentlyContinue
73-
throw "tsaoptions.json does not exist under $(Build.SourcesDirectory)/OSS_Microsoft_PSSA/.config"
82+
throw "tsaoptions.json does not exist under $(repoRoot)/.config"
7483
}
7584
displayName: Test if tsaoptions.json exists
85+
env:
86+
ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.
87+
88+
- task: UseDotNet@2
89+
displayName: 'Install .NET dependencies'
90+
env:
91+
ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.
92+
inputs:
93+
packageType: 'sdk'
94+
useGlobalJson: true
95+
# this is to ensure that we are installing the dotnet at the same location as container by default install the dotnet sdks
96+
installationPath: 'C:\Program Files\dotnet\'
97+
workingDirectory: $(repoRoot)
7698

77-
#- pwsh: |
78-
# New-Item -ItemType Directory -Path $(Build.SourcesDirectory)/.config -Force -Verbose
79-
# Copy-Item '$(Build.SourcesDirectory)/OSS_Microsoft_PSSA/.config/tsaoptions.json' '$(Build.SourcesDirectory)/.config/tsaoptions.json' -Force -Verbose
80-
# displayName: Copy tsaoptions
99+
- task: CodeQL3000Init@0 # Add CodeQL Init task right before your 'Build' step.
100+
env:
101+
ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.
102+
inputs:
103+
Enabled: true
104+
AnalyzeInPipeline: true
105+
Language: csharp
81106

107+
# this is installing .NET
82108
- pwsh: |
83-
Set-Location "$(Build.SourcesDirectory)/OSS_Microsoft_PSSA"
109+
Set-Location "$(repoRoot)"
84110
try { ./build.ps1 -Configuration Release -All } catch { throw $_ }
85111
displayName: Execute build
112+
env:
113+
ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.
114+
115+
- task: CodeQL3000Finalize@0 # Add CodeQL Finalize task right after your 'Build' step.
116+
condition: always()
117+
env:
118+
ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.
119+
120+
- task: onebranch.pipeline.signing@1
121+
displayName: Sign 1st party files
122+
inputs:
123+
command: 'sign'
124+
signing_profile: external_distribution
125+
files_to_sign: '**\*.psd1;**\*.psm1;**\*.ps1xml;**\Microsoft*.dll'
126+
search_root: $(signSrcPath)
127+
128+
- task: onebranch.pipeline.signing@1
129+
displayName: Sign 3rd Party files
130+
inputs:
131+
command: 'sign'
132+
signing_profile: 135020002
133+
files_to_sign: '**/Pluralize*.dll;**/Newtonsoft*.dll'
134+
search_root: $(signSrcPath)
135+
136+
- task: CopyFiles@2
137+
displayName: "Copy signed files to ob_outputDirectory - '$(ob_outputDirectory)'"
138+
inputs:
139+
SourceFolder: "$(signSrcPath)"
140+
Contents: '**'
141+
TargetFolder: $(ob_outputDirectory)
86142

87143
- pwsh: |
88-
$signSrcPath = "$(Build.SourcesDirectory)/OSS_Microsoft_PSSA/out"
89-
# Set signing src path variable
90-
$vstsCommandString = "vso[task.setvariable variable=signSrcPath]${signSrcPath}"
91-
Write-Host "sending $vstsCommandString"
92-
Write-Host "##$vstsCommandString"
93-
$signOutStep1 = "$(Build.SourcesDirectory)/OSS_Microsoft_PSSA/Step1"
94-
$null = New-Item -ItemType Directory -Path $signOutStep1
95-
# Set signing out path variable
96-
$vstsCommandString = "vso[task.setvariable variable=signOutStep1]${signOutStep1}"
97-
Write-Host "sending $vstsCommandString"
98-
Write-Host "##$vstsCommandString"
99-
$signOutPath = "$(Build.SourcesDirectory)/OSS_Microsoft_PSSA/signed"
100-
$null = New-Item -ItemType Directory -Path $signOutPath
101-
# Set signing out path variable
102-
$vstsCommandString = "vso[task.setvariable variable=signOutPath]${signOutPath}"
103-
Write-Host "sending $vstsCommandString"
104-
Write-Host "##$vstsCommandString"
105-
# Set path variable for guardian codesign validation
106-
$vstsCommandString = "vso[task.setvariable variable=GDN_CODESIGN_TARGETDIRECTORY]${signOutPath}"
107-
Write-Host "sending $vstsCommandString"
108-
Write-Host "##$vstsCommandString"
109-
# Get version and create a variable
110-
$moduleData = Import-PowerShellDataFile "$(Build.SourcesDirectory)/OSS_Microsoft_PSSA/Engine/PSScriptAnalyzer.psd1"
144+
$moduleData = Import-PowerShellDataFile "$(repoRoot)/Engine/PSScriptAnalyzer.psd1"
111145
$moduleVersion = $moduleData.ModuleVersion
112-
$vstsCommandString = "vso[task.setvariable variable=moduleVersion]${moduleVersion}"
146+
$vstsCommandString = "vso[task.setvariable variable=ob_sdl_sbom_packageversion]${moduleVersion}"
147+
113148
Write-Host "sending $vstsCommandString"
114149
Write-Host "##$vstsCommandString"
115-
displayName: Setup variables for signing
116-
117-
- template: EsrpSign.yml@ComplianceRepo
118-
parameters:
119-
buildOutputPath: $(signSrcPath)
120-
signOutputPath: $(signOutStep1)
121-
certificateId: "CP-230012"
122-
useMinimatch: true
123-
pattern: |
124-
**\*.psd1
125-
**\*.psm1
126-
**\*.ps1xml
127-
**\Microsoft*.dll
128-
129-
- template: EsrpSign.yml@ComplianceRepo
130-
parameters:
131-
buildOutputPath: $(signOutStep1)
132-
signOutputPath: $(signOutPath)
133-
certificateId: "CP-231522"
134-
useMinimatch: true
135-
pattern: |
136-
**/Pluralize*.dll
137-
**/Newtonsoft*.dll
138-
139-
- template: Sbom.yml@ComplianceRepo
140-
parameters:
141-
BuildDropPath: $(signOutPath)
142-
Build_Repository_Uri: 'https://github.com/powershell/PSScriptAnalyzer'
150+
displayName: Setup SBOM Package Version
151+
152+
- job: nupkg
153+
dependsOn: jobbuild
154+
displayName: Package Microsoft.PowerShell.ScriptAnalyzer
155+
variables:
156+
- name: ob_outputDirectory
157+
value: '$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT'
158+
- name: repoRoot
159+
value: $(Build.SourcesDirectory)\OSS_Microsoft_PSSA
160+
- name: ob_sdl_tsa_configFile
161+
value: $(Build.SourcesDirectory)\OSS_Microsoft_PSSA\.config\tsaoptions.json
162+
# Disable because SBOM was already built in the previous job
163+
- name: ob_sdl_sbom_enabled
164+
value: false
165+
- name: signOutPath
166+
value: $(repoRoot)/signed
167+
- name: ob_signing_setup_enabled
168+
value: true
169+
# This job is not compiling code, so disable codeQL
170+
- name: ob_sdl_codeql_compiled_enabled
171+
value: false
172+
173+
pool:
174+
type: windows
175+
steps:
176+
- checkout: self
177+
178+
- pwsh: |
179+
if (-not (Test-Path $(repoRoot)/.config/tsaoptions.json)) {
180+
Get-ChildItem $(Build.SourcesDirectory) -recurse -ErrorAction SilentlyContinue
181+
throw "tsaoptions.json does not exist under $(repoRoot)/.config"
182+
}
183+
displayName: Test if tsaoptions.json exists
184+
185+
- task: DownloadPipelineArtifact@2
186+
displayName: 'Download build files'
187+
inputs:
188+
targetPath: $(signOutPath)
189+
artifact: drop_stagebuild_jobbuild
143190

144191
- pwsh: |
145-
Set-Location "$(Build.SourcesDirectory)/OSS_Microsoft_PSSA"
192+
Set-Location "$(signOutPath)"
193+
dir -dir -recurse *
194+
displayName: Capture artifacts structure
195+
196+
- pwsh: |
197+
Set-Location "$(repoRoot)"
146198
./build -BuildNupkg -CopyManifest -signed
147199
displayName: Create nupkg for publishing
148200
149-
- task: CopyFiles@2
150-
displayName: "Copy Files for 'publish build directory' publish task"
201+
- task: onebranch.pipeline.signing@1
202+
displayName: Sign nupkg
151203
inputs:
152-
SourceFolder: "$(Build.SourcesDirectory)/OSS_Microsoft_PSSA"
153-
Contents: '**'
154-
TargetFolder: $(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT/build
204+
command: 'sign'
205+
signing_profile: external_distribution
206+
files_to_sign: '**\*.nupkg'
207+
search_root: $(signOutPath)
208+
209+
- pwsh: |
210+
Set-Location "$(repoRoot)"
211+
dir -file -recurse *.nupkg
212+
displayName: Find Nupkg
155213
156214
- task: CopyFiles@2
157-
displayName: "Copy Files for 'Publish module nupkg' publish task"
215+
displayName: "Copy nupkg to ob_outputDirectory - '$(ob_outputDirectory)'"
158216
inputs:
159-
Contents: "$(signOutPath)/PSScriptAnalyzer.$(moduleVersion).nupkg"
160-
TargetFolder: $(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT/nupkg
217+
Contents: "$(repoRoot)/**/PSScriptAnalyzer.*.nupkg"
218+
TargetFolder: $(ob_outputDirectory)

0 commit comments

Comments
 (0)